@camstack/addon-auth 1.2.144 → 1.2.145

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-0YTEFDYk.js");
+const require_dist = require("../dist-Be0i-dLp.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -938,6 +938,28 @@ var STATE_TTL_MS = 5 * 6e4;
 var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
+/** In-flight logins one client may hold (D858): one browser flooding `/start` cannot fill the map for everyone. */
+var MAX_PENDING_PER_CLIENT = 20;
+/**
+* A step-up must follow a login that happened no earlier than this before the
+* flow began (D858). The authorize request asks for `prompt=login&max_age=0`;
+* this is the check that the IdP actually honoured it.
+*/
+var STEP_UP_MAX_AUTH_AGE_MS = 6e4;
+/** The pending map is full, or this client already holds its share. Live states are never evicted for it. */
+var PendingStatesFullError = class extends Error {};
+/** A step-up whose id_token proves no login just before the flow began. */
+var StepUpNotFreshError = class extends Error {};
+/**
+* Who a `/start` is counted against. The hub already limits each real client
+* address per minute before a route runs; the addon sees only headers, so this
+* is a best-effort key (a spoofed header only rotates the bucket, and the
+* hub's limit and the global cap still bound the total).
+*/
+function clientKeyOf(headers) {
+	const forwarded = headers?.["x-forwarded-for"]?.split(",")[0]?.trim();
+	return headers?.["cf-connecting-ip"] ?? headers?.["x-real-ip"] ?? forwarded ?? "unknown";
+}
 /**
 * Origin + mount prefix of a pinned `redirect_uri`: the part before the
 * callback path when it ends with it, else just its origin.
@@ -1108,7 +1130,11 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				icon: require_dist.resolveIconKey(inst.config.icon, DEFAULT_PROVIDER.icon),
 				startUrl: `/addon/auth-oidc/${id}/start`,
 				stage: "primary",
-				linkable: true
+				linkable: true,
+				app: {
+					kind: "browser",
+					startPath: `/addon/auth-oidc/${id}/start`
+				}
 			});
 		}
 		return out;
@@ -1244,12 +1270,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const nonce = node_crypto.randomBytes(16).toString("base64url");
 		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
-		while (this.pendingStates.size >= MAX_PENDING_STATES) {
-			const oldest = this.pendingStates.keys().next();
-			if (oldest.done) break;
-			this.pendingStates.delete(oldest.value);
-		}
+		const clientKey = clientKeyOf(options.headers);
+		if (this.pendingStates.size >= MAX_PENDING_STATES || [...this.pendingStates.values()].filter((p) => p.clientKey === clientKey).length >= MAX_PENDING_PER_CLIENT) throw new PendingStatesFullError("Too many sign-ins in progress - try again shortly");
 		this.pendingStates.set(state, {
+			clientKey,
 			codeVerifier,
 			nonce,
 			providerId,
@@ -1258,7 +1282,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			popup: options.popup === true,
 			createdAt: Date.now(),
 			...linkIntent !== void 0 ? { linkIntent } : {},
-			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {}
+			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {},
+			...options.app !== void 0 ? { app: options.app } : {}
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
@@ -1270,17 +1295,27 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
+		if (options.app?.purpose === "step-up") {
+			params.set("prompt", "login");
+			params.set("max_age", "0");
+		}
 		return {
 			url: `${doc.authorization_endpoint}?${params.toString()}`,
 			returnBase
 		};
 	}
+	/** The pending state for `state`, unless it is gone or older than its TTL. */
+	livePending(state) {
+		const pending = this.pendingStates.get(state);
+		if (pending === void 0) return void 0;
+		return Date.now() - pending.createdAt > STATE_TTL_MS ? void 0 : pending;
+	}
 	pruneExpiredStates() {
 		const now = Date.now();
 		for (const [k, v] of this.pendingStates.entries()) if (now - v.createdAt > STATE_TTL_MS) this.pendingStates.delete(k);
 	}
 	async handleCallback(code, state) {
-		const pending = this.pendingStates.get(state);
+		const pending = this.livePending(state);
 		if (!pending) throw new Error("Unknown or expired OIDC state — login session timed out, please retry");
 		this.pendingStates.delete(state);
 		const providerId = pending.providerId;
@@ -1321,6 +1356,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			throw new Error(`OIDC id_token verification failed: ${require_dist.errMsg(err)}`, { cause: err });
 		}
 		if (typeof payload["nonce"] !== "string" || payload["nonce"] !== pending.nonce) throw new Error("OIDC id_token nonce mismatch — possible replay attack");
+		if (pending.app?.purpose === "step-up") {
+			const authTime = payload["auth_time"];
+			if (typeof authTime !== "number" || !Number.isFinite(authTime) || authTime * 1e3 < pending.createdAt - STEP_UP_MAX_AUTH_AGE_MS) throw new StepUpNotFreshError("OIDC step-up id_token proves no fresh login");
+		}
 		const sub = typeof payload.sub === "string" ? payload.sub : null;
 		if (!sub) throw new Error("OIDC callback: id_token missing required `sub` claim");
 		const emailClaim = typeof payload["email"] === "string" ? payload["email"] : void 0;
@@ -1339,7 +1378,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			providerId,
 			returnBase: pending.returnBase,
 			popup: pending.popup,
-			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {}
+			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {},
+			...pending.app !== void 0 ? { app: pending.app } : {}
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1358,21 +1398,52 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			reply.send({ error: "Malformed link request" });
 			return;
 		}
-		const popupParam = req.query["popup"];
-		const state = node_crypto.randomBytes(16).toString("base64url");
+		const query = req.query;
+		const popupParam = query["popup"];
+		let app;
+		if (query["app"] === "1") {
+			const parsed = require_dist.parseAppFlowRequest(query);
+			if (linkParam !== void 0 || popupParam === "1" || !parsed.ok) {
+				this.ctx.logger.warn("OIDC app sign-in refused at start", { meta: {
+					provider: providerId,
+					reason: parsed.ok ? "combined-flow" : parsed.reason
+				} });
+				reply.code(400);
+				reply.type("text/html; charset=utf-8");
+				reply.header("Cache-Control", "no-store");
+				reply.send(appRefusalPage(parsed.ok ? "An app sign-in cannot be combined with linking or a popup." : require_dist.APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+				return;
+			}
+			app = parsed.request;
+		}
+		const state = `${app !== void 0 ? "a." : ""}${node_crypto.randomBytes(16).toString("base64url")}`;
 		const browserState = node_crypto.randomBytes(32).toString("base64url");
 		try {
 			const { url, returnBase } = await this.prepareLogin(providerId, state, {
 				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
 				headers: req.headers,
 				popup: popupParam === "1",
-				browserBinding: node_crypto.createHash("sha256").update(browserState).digest("hex")
+				browserBinding: node_crypto.createHash("sha256").update(browserState).digest("hex"),
+				...app !== void 0 ? { app } : {}
 			});
 			reply.code(302);
 			reply.header("Set-Cookie", ssoStateCookie(browserState, returnBase.startsWith("https:")));
 			reply.header("Location", url);
 			reply.send("");
 		} catch (err) {
+			if (err instanceof PendingStatesFullError) {
+				this.ctx.logger.warn("OIDC sign-in refused: too many in progress", { meta: { provider: providerId } });
+				if (app !== void 0) {
+					reply.code(302);
+					reply.header("Location", require_dist.appFlowLocation(app.redirect, { error: "too-many-requests" }, app.state));
+					reply.send("");
+					return;
+				}
+				reply.code(429);
+				reply.header("Retry-After", "30");
+				reply.send({ error: "Too many sign-ins in progress - try again shortly" });
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC start failed",
@@ -1391,6 +1462,27 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const code = query["code"];
 		const state = query["state"];
 		const errorParam = query["error"];
+		const pendingApp = state !== void 0 ? this.livePending(state)?.app : void 0;
+		const appFlowState = state?.startsWith("a.") === true;
+		const answerApp = (error) => {
+			this.ctx.logger.warn("OIDC app sign-in refused at callback", { meta: {
+				provider: providerId,
+				error
+			} });
+			if (state !== void 0) this.pendingStates.delete(state);
+			reply.code(302);
+			reply.header("Cache-Control", "no-store");
+			reply.header("Location", pendingApp !== void 0 ? require_dist.appFlowLocation(pendingApp.redirect, { error }, pendingApp.state) : require_dist.appFlowLocation(require_dist.APP_FLOW_DEFAULT_REDIRECT, { error }));
+			reply.send("");
+		};
+		if (appFlowState && pendingApp === void 0) {
+			answerApp(errorParam ? "idp-error" : "state-expired");
+			return;
+		}
+		if (errorParam && pendingApp !== void 0) {
+			answerApp("idp-error");
+			return;
+		}
 		if (errorParam) {
 			reply.code(400);
 			reply.send({
@@ -1408,6 +1500,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		try {
 			const result = await this.handleCallback(code, state);
 			if (result.providerId !== providerId) {
+				if (result.app !== void 0) {
+					answerApp("provider-mismatch");
+					return;
+				}
 				reply.code(400);
 				reply.send({ error: "OIDC callback does not match the provider the login started at" });
 				return;
@@ -1422,14 +1518,25 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
 				issuer: result.issuer,
 				jti: node_crypto.randomBytes(16).toString("base64url"),
-				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {}
+				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {},
+				...result.app !== void 0 ? { app: {
+					codeChallenge: result.app.codeChallenge,
+					state: result.app.state,
+					purpose: result.app.purpose,
+					redirect: result.app.redirect
+				} } : {}
 			} });
 			const finish = new URLSearchParams({ bridge: bridgeToken });
 			if (result.popup) finish.set("popup", "1");
+			const finishPath = result.app !== void 0 ? "finish-app" : "finish";
 			reply.code(302);
-			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/${finishPath}?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
+			if (pendingApp !== void 0) {
+				answerApp(err instanceof StepUpNotFreshError ? "step-up-not-fresh" : "idp-failed");
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC callback failed",
@@ -1438,6 +1545,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		}
 	}
 };
+/** Minimal standalone page for a refused app sign-in request (D858) - no assets, no script. */
+function appRefusalPage(message) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem"><h1>Sign-in request refused</h1><p>${message.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)}</p><p>Close this window and try again from the app.</p></body></html>`;
+}
 /**
 * The browser-binding cookie (`SSO_STATE_COOKIE`). HttpOnly, Lax (the IdP
 * returns with a top-level GET), path `/` so it reaches the hub's finish under

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { S as toSecretFieldView, _ as SECRET_CLEAR, a as authProviderCapability, b as isSecretClear, c as loginMethodCapability, d as pickRequestOrigin, f as requestMountPrefix, g as BaseAddon, h as errMsg, i as advertisedHubOrigins, l as normalizeOrigin, n as addonRoutesCapability, o as buildAddonRouteProvider, p as resolveIconKey, s as claimedRequestOrigins, t as SSO_STATE_COOKIE, u as oidcConnectionsCapability, v as arrayItemFieldPath, x as isSecretMarker, y as globalSecretScope } from "../dist-ChwITXNa.mjs";
+import { C as globalSecretScope, E as toSecretFieldView, S as arrayItemFieldPath, T as isSecretMarker, _ as resolveIconKey, b as BaseAddon, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as requestMountPrefix, h as pickRequestOrigin, i as addonRoutesCapability, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_FLOW_REFUSAL_MESSAGES, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, w as isSecretClear, x as SECRET_CLEAR, y as errMsg } from "../dist-B2h4Ziv7.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -933,6 +933,28 @@ var STATE_TTL_MS = 5 * 6e4;
 var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
+/** In-flight logins one client may hold (D858): one browser flooding `/start` cannot fill the map for everyone. */
+var MAX_PENDING_PER_CLIENT = 20;
+/**
+* A step-up must follow a login that happened no earlier than this before the
+* flow began (D858). The authorize request asks for `prompt=login&max_age=0`;
+* this is the check that the IdP actually honoured it.
+*/
+var STEP_UP_MAX_AUTH_AGE_MS = 6e4;
+/** The pending map is full, or this client already holds its share. Live states are never evicted for it. */
+var PendingStatesFullError = class extends Error {};
+/** A step-up whose id_token proves no login just before the flow began. */
+var StepUpNotFreshError = class extends Error {};
+/**
+* Who a `/start` is counted against. The hub already limits each real client
+* address per minute before a route runs; the addon sees only headers, so this
+* is a best-effort key (a spoofed header only rotates the bucket, and the
+* hub's limit and the global cap still bound the total).
+*/
+function clientKeyOf(headers) {
+	const forwarded = headers?.["x-forwarded-for"]?.split(",")[0]?.trim();
+	return headers?.["cf-connecting-ip"] ?? headers?.["x-real-ip"] ?? forwarded ?? "unknown";
+}
 /**
 * Origin + mount prefix of a pinned `redirect_uri`: the part before the
 * callback path when it ends with it, else just its origin.
@@ -1103,7 +1125,11 @@ var AuthOidcAddon = class extends BaseAddon {
 				icon: resolveIconKey(inst.config.icon, DEFAULT_PROVIDER.icon),
 				startUrl: `/addon/auth-oidc/${id}/start`,
 				stage: "primary",
-				linkable: true
+				linkable: true,
+				app: {
+					kind: "browser",
+					startPath: `/addon/auth-oidc/${id}/start`
+				}
 			});
 		}
 		return out;
@@ -1239,12 +1265,10 @@ var AuthOidcAddon = class extends BaseAddon {
 		const nonce = crypto$1.randomBytes(16).toString("base64url");
 		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
-		while (this.pendingStates.size >= MAX_PENDING_STATES) {
-			const oldest = this.pendingStates.keys().next();
-			if (oldest.done) break;
-			this.pendingStates.delete(oldest.value);
-		}
+		const clientKey = clientKeyOf(options.headers);
+		if (this.pendingStates.size >= MAX_PENDING_STATES || [...this.pendingStates.values()].filter((p) => p.clientKey === clientKey).length >= MAX_PENDING_PER_CLIENT) throw new PendingStatesFullError("Too many sign-ins in progress - try again shortly");
 		this.pendingStates.set(state, {
+			clientKey,
 			codeVerifier,
 			nonce,
 			providerId,
@@ -1253,7 +1277,8 @@ var AuthOidcAddon = class extends BaseAddon {
 			popup: options.popup === true,
 			createdAt: Date.now(),
 			...linkIntent !== void 0 ? { linkIntent } : {},
-			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {}
+			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {},
+			...options.app !== void 0 ? { app: options.app } : {}
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
@@ -1265,17 +1290,27 @@ var AuthOidcAddon = class extends BaseAddon {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
+		if (options.app?.purpose === "step-up") {
+			params.set("prompt", "login");
+			params.set("max_age", "0");
+		}
 		return {
 			url: `${doc.authorization_endpoint}?${params.toString()}`,
 			returnBase
 		};
 	}
+	/** The pending state for `state`, unless it is gone or older than its TTL. */
+	livePending(state) {
+		const pending = this.pendingStates.get(state);
+		if (pending === void 0) return void 0;
+		return Date.now() - pending.createdAt > STATE_TTL_MS ? void 0 : pending;
+	}
 	pruneExpiredStates() {
 		const now = Date.now();
 		for (const [k, v] of this.pendingStates.entries()) if (now - v.createdAt > STATE_TTL_MS) this.pendingStates.delete(k);
 	}
 	async handleCallback(code, state) {
-		const pending = this.pendingStates.get(state);
+		const pending = this.livePending(state);
 		if (!pending) throw new Error("Unknown or expired OIDC state — login session timed out, please retry");
 		this.pendingStates.delete(state);
 		const providerId = pending.providerId;
@@ -1316,6 +1351,10 @@ var AuthOidcAddon = class extends BaseAddon {
 			throw new Error(`OIDC id_token verification failed: ${errMsg(err)}`, { cause: err });
 		}
 		if (typeof payload["nonce"] !== "string" || payload["nonce"] !== pending.nonce) throw new Error("OIDC id_token nonce mismatch — possible replay attack");
+		if (pending.app?.purpose === "step-up") {
+			const authTime = payload["auth_time"];
+			if (typeof authTime !== "number" || !Number.isFinite(authTime) || authTime * 1e3 < pending.createdAt - STEP_UP_MAX_AUTH_AGE_MS) throw new StepUpNotFreshError("OIDC step-up id_token proves no fresh login");
+		}
 		const sub = typeof payload.sub === "string" ? payload.sub : null;
 		if (!sub) throw new Error("OIDC callback: id_token missing required `sub` claim");
 		const emailClaim = typeof payload["email"] === "string" ? payload["email"] : void 0;
@@ -1334,7 +1373,8 @@ var AuthOidcAddon = class extends BaseAddon {
 			providerId,
 			returnBase: pending.returnBase,
 			popup: pending.popup,
-			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {}
+			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {},
+			...pending.app !== void 0 ? { app: pending.app } : {}
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1353,21 +1393,52 @@ var AuthOidcAddon = class extends BaseAddon {
 			reply.send({ error: "Malformed link request" });
 			return;
 		}
-		const popupParam = req.query["popup"];
-		const state = crypto$1.randomBytes(16).toString("base64url");
+		const query = req.query;
+		const popupParam = query["popup"];
+		let app;
+		if (query["app"] === "1") {
+			const parsed = parseAppFlowRequest(query);
+			if (linkParam !== void 0 || popupParam === "1" || !parsed.ok) {
+				this.ctx.logger.warn("OIDC app sign-in refused at start", { meta: {
+					provider: providerId,
+					reason: parsed.ok ? "combined-flow" : parsed.reason
+				} });
+				reply.code(400);
+				reply.type("text/html; charset=utf-8");
+				reply.header("Cache-Control", "no-store");
+				reply.send(appRefusalPage(parsed.ok ? "An app sign-in cannot be combined with linking or a popup." : APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+				return;
+			}
+			app = parsed.request;
+		}
+		const state = `${app !== void 0 ? "a." : ""}${crypto$1.randomBytes(16).toString("base64url")}`;
 		const browserState = crypto$1.randomBytes(32).toString("base64url");
 		try {
 			const { url, returnBase } = await this.prepareLogin(providerId, state, {
 				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
 				headers: req.headers,
 				popup: popupParam === "1",
-				browserBinding: crypto$1.createHash("sha256").update(browserState).digest("hex")
+				browserBinding: crypto$1.createHash("sha256").update(browserState).digest("hex"),
+				...app !== void 0 ? { app } : {}
 			});
 			reply.code(302);
 			reply.header("Set-Cookie", ssoStateCookie(browserState, returnBase.startsWith("https:")));
 			reply.header("Location", url);
 			reply.send("");
 		} catch (err) {
+			if (err instanceof PendingStatesFullError) {
+				this.ctx.logger.warn("OIDC sign-in refused: too many in progress", { meta: { provider: providerId } });
+				if (app !== void 0) {
+					reply.code(302);
+					reply.header("Location", appFlowLocation(app.redirect, { error: "too-many-requests" }, app.state));
+					reply.send("");
+					return;
+				}
+				reply.code(429);
+				reply.header("Retry-After", "30");
+				reply.send({ error: "Too many sign-ins in progress - try again shortly" });
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC start failed",
@@ -1386,6 +1457,27 @@ var AuthOidcAddon = class extends BaseAddon {
 		const code = query["code"];
 		const state = query["state"];
 		const errorParam = query["error"];
+		const pendingApp = state !== void 0 ? this.livePending(state)?.app : void 0;
+		const appFlowState = state?.startsWith("a.") === true;
+		const answerApp = (error) => {
+			this.ctx.logger.warn("OIDC app sign-in refused at callback", { meta: {
+				provider: providerId,
+				error
+			} });
+			if (state !== void 0) this.pendingStates.delete(state);
+			reply.code(302);
+			reply.header("Cache-Control", "no-store");
+			reply.header("Location", pendingApp !== void 0 ? appFlowLocation(pendingApp.redirect, { error }, pendingApp.state) : appFlowLocation(APP_FLOW_DEFAULT_REDIRECT, { error }));
+			reply.send("");
+		};
+		if (appFlowState && pendingApp === void 0) {
+			answerApp(errorParam ? "idp-error" : "state-expired");
+			return;
+		}
+		if (errorParam && pendingApp !== void 0) {
+			answerApp("idp-error");
+			return;
+		}
 		if (errorParam) {
 			reply.code(400);
 			reply.send({
@@ -1403,6 +1495,10 @@ var AuthOidcAddon = class extends BaseAddon {
 		try {
 			const result = await this.handleCallback(code, state);
 			if (result.providerId !== providerId) {
+				if (result.app !== void 0) {
+					answerApp("provider-mismatch");
+					return;
+				}
 				reply.code(400);
 				reply.send({ error: "OIDC callback does not match the provider the login started at" });
 				return;
@@ -1417,14 +1513,25 @@ var AuthOidcAddon = class extends BaseAddon {
 				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
 				issuer: result.issuer,
 				jti: crypto$1.randomBytes(16).toString("base64url"),
-				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {}
+				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {},
+				...result.app !== void 0 ? { app: {
+					codeChallenge: result.app.codeChallenge,
+					state: result.app.state,
+					purpose: result.app.purpose,
+					redirect: result.app.redirect
+				} } : {}
 			} });
 			const finish = new URLSearchParams({ bridge: bridgeToken });
 			if (result.popup) finish.set("popup", "1");
+			const finishPath = result.app !== void 0 ? "finish-app" : "finish";
 			reply.code(302);
-			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/${finishPath}?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
+			if (pendingApp !== void 0) {
+				answerApp(err instanceof StepUpNotFreshError ? "step-up-not-fresh" : "idp-failed");
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC callback failed",
@@ -1433,6 +1540,10 @@ var AuthOidcAddon = class extends BaseAddon {
 		}
 	}
 };
+/** Minimal standalone page for a refused app sign-in request (D858) - no assets, no script. */
+function appRefusalPage(message) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem"><h1>Sign-in request refused</h1><p>${message.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)}</p><p>Close this window and try again from the app.</p></body></html>`;
+}
 /**
 * The browser-binding cookie (`SSO_STATE_COOKIE`). HttpOnly, Lax (the IdP
 * returns with a top-level GET), path `/` so it reaches the hub's finish under

package/dist/webauthn/_stub.js

@@ -1,6 +1,6 @@
 import { n as e, r as t, t as n } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react__loadShare__.js-BIIa6vDX.mjs";
 import { n as r, t as i } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-CQ-aEQ9b.mjs";
-import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-xhY74yma.mjs";
+import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-DSXWgur5.mjs";
 import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
 var l = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), u = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), d = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), f = (e) => {

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-ZRpCO_gp.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DuRYyuGp.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.365",
+		version: "1.2.370",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.288",
+		version: "1.2.289",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",